Why, nothing, of course. Instead, their emails can simply not directly disclose any of a consumer's personal info. They can link back to their site with a URL full of ?custID=gibberish?orderID=ghgfh that produces a login prompt and requires a previously established password before it will reveal any data, unless the original customer goes there and hasn't cleared out the cookie set when they logged in before to place the order of course.

The email could say something like order number xyz has now been shipped or whatever, without revealing what the product actually is or where it's going, providing such a link as described above to actually confirm such details; most customers are likely just to be satisfied with the message saying that the thing is on the way though.